Re: [PATCH v2 2/2] mm/hugetlb: optimize bootmem hugepage tail vmemmap init

[Muchun Song <muchun.song@linux.dev>]

On 2026/11/11 11:14, Li Zhe wrote:
> On 11/10/26 9:35 PM, sashiko-bot@kernel.org wrote:
>> Thank you for your contribution! Sashiko AI review found 1 potential
>> issue to consider:
>> - [High] mm/hugetlb: out-of-bounds write in
>>     hugetlb_folio_init_tail_vmemmap()
>> --
>>
>> commit 5be89b38412d58045fd600596787f54c7559d32c
>> Author: Li Zhe <lizhe.67@bytedance.com>
>>
>> mm/hugetlb: optimize bootmem hugepage tail vmemmap init
>>
>> This commit optimizes bootmem hugepage tail struct page initialization by
>> seeding a template from the first tail page and initializing the remaining
>> tail pages via memmap_init_page_from_template().
>>
>>> diff --git a/mm/hugetlb.c b/mm/hugetlb.c
>>> index cb2de24affdc4..6ae5d2679e3aa 100644
>>> --- a/mm/hugetlb.c
>>> +++ b/mm/hugetlb.c
>>> @@ -3239,6 +3239,7 @@ static void __init hugetlb_folio_init_tail_vmemmap(struct folio *folio,
>>>    	enum zone_type zone = folio_zonenum(folio);
>>>    	int nid = folio_nid(folio);
>>>    	struct page *page = folio_page(folio, start_page_number);
>>> +	struct page template;
>>>    	unsigned long head_pfn = folio_pfn(folio);
>>>    	unsigned long pfn, end_pfn = head_pfn + end_page_number;
>>>    	unsigned int order = huge_page_order(h);
>>> @@ -3247,11 +3248,20 @@ static void __init hugetlb_folio_init_tail_vmemmap(struct folio *folio,
>>>    	 * As we marked all tail pages with memblock_reserved_mark_noinit(),
>>>    	 * we must initialize them ourselves here.
>>>    	 */
>>> -	for (pfn = head_pfn + start_page_number; pfn < end_pfn; page++, pfn++) {
>>> -		__init_single_page(page, pfn, zone, nid);
>>> -		prep_compound_tail(page, &folio->page, order);
>>> -		set_page_count(page, 0);
>>> -	}
>>> +	pfn = head_pfn + start_page_number;
>>> +
>>> +	/*
>>> +	 * Seed a template from the first real tail page and refresh only
>>> +	 * PFN-dependent fields before copying it.
>>> +	 */
>>> +	__init_single_page(page, pfn, zone, nid);
>>> +	prep_compound_tail(page, &folio->page, order);
>>> +	set_page_count(page, 0);
>>> +	memcpy(&template, page, sizeof(template));
>>> +
>>> +	for (pfn++; pfn < end_pfn; pfn++)
>>> +		memmap_init_page_from_template(pfn_to_page(pfn), pfn, zone,
>>> +					       &template);
>> [Severity: High]
>> Can peeling the first iteration out of the loop overwrite the struct page
>> past the end of folio when start_page_number >= end_page_number?
>>
>> Previously, the loop was a no-op when pfn >= end_pfn.  Now, when HVO does
>> not optimize a gigantic folio, prep_and_add_bootmem_folios() calls
>> hugetlb_folio_init_tail_vmemmap(folio, h,
>> VMEMMAP_OPTIMIZATION_NR_STRUCT_PAGES, pages_per_huge_page(h)) after
>> gather_bootmem_prealloc_node() has already initialized the first
>> VMEMMAP_OPTIMIZATION_NR_STRUCT_PAGES pages.
>>
>> On configurations where a gigantic page has pages_per_huge_page(h) <=
>> VMEMMAP_OPTIMIZATION_NR_STRUCT_PAGES (for example, powerpc
>> mpc885_ads_defconfig with 16 KiB pages, MAX_PAGE_ORDER == 8, and 8 MiB
>> gigantic hugepages of order 9, where both values are 512), this
>> unconditionally initializes folio_page(folio, start_page_number) and marks
>> the adjacent physical page's struct page as a compound tail of folio,
>> corrupting mem_map.
>
> Thanks for the report. This looks valid.
>
> I will restore the empty-range check before seeding the template in v3.

Go ahead. I will end up removing this empty-range check here [1].

[1] 
https://lore.kernel.org/all/20261109095807.41547-8-songmuchun@bytedance.com/

>
> Thanks,
> Zhe